CVE-2025-9214

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-09-11 · updated 2026-10-18
Weakness: CWE-306

Description

A missing authentication vulnerability was reported in some Lenovo printers that could allow a user to view limited device information or modify network settings via the CUPS service.

Affected products

Lenovo LJ2206W Printer: before Ver.D(1.05) — fixed in Ver.D(1.05)
Lenovo LJ2655DN Printer: before Ver.E(1.06) — fixed in Ver.E(1.06)
Lenovo M7206W Printer: before Ver.F — fixed in Ver.F
Lenovo M7216NWA Printer: before Ver.F — fixed in Ver.F
Lenovo M7256WHF Printer: before Ver.F — fixed in Ver.F
Lenovo M7455DNF Printer: before Ver.E — fixed in Ver.E
Lenovo M7615DNA: before Ver.D — fixed in Ver.D
Lenovo M7626DNA Printer: before Ver.D — fixed in Ver.D
Lenovo M7628DNA Printer: before Ver.D — fixed in Ver.D
Lenovo M7675DXF Printer: before Ver.E — fixed in Ver.E
Lenovo M7685DXF Printer: before Ver.E — fixed in Ver.E
Lenovo M7686DXF: before Ver.E — fixed in Ver.E

How to fix

Upgrade to a fixed version: Lenovo LJ2206W Printer Ver.D(1.05); Lenovo LJ2655DN Printer Ver.E(1.06); Lenovo M7206W Printer Ver.F; Lenovo M7216NWA Printer Ver.F; Lenovo M7256WHF Printer Ver.F; Lenovo M7455DNF Printer Ver.E; Lenovo M7615DNA Ver.D; Lenovo M7626DNA Printer Ver.D; Lenovo M7628DNA Printer Ver.D; Lenovo M7675DXF Printer Ver.E; Lenovo M7685DXF Printer Ver.E; Lenovo M7686DXF Ver.E. Check the vendor advisory for mitigations.

References

https://iknow.lenovo.com.cn/detail/431734

Get alerted when CVE-2025-9214 or the next vulnerability affects your stack